SUSPICIOUS — 86975186974.pdf

SUSPICIOUS — 86975186974.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 4af32a8b88edc8fcd09a98e30116579251aa3186ebdb750d3bef2520c32cd046
• SHA-1: a0df671decbb23b43534dc3de5cce5ef6c994352
• MD5: c477f13340f69529013058b45a377d46
• ssdeep: 768:6gGzpDfdFlYts4IzA5ff9McXmf570Ec0EFXG:nGFT2iA5cf6zhFXG
• TLSH: T1592F6DF314A7EC9C7A96AB03A9E71459A04AC78C6136D76044D8B73DC4FC2BDAE10861
• Submitted as: 86975186974.pdf
• File type: pdf · Size: 35487 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=9th+dawn+guide, http://pujot.orchardviewchoir.com/uploads/1/3/2/8/132815114/bedoxakiduvekavibu.pdf, http://files.smalladventuresphotography.com/uploads/1/3/1/4/131437308/5673125.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ggtraff.ru/strik?keyword=9th+dawn+guide
• http://pujot.orchardviewchoir.com/uploads/1/3/2/8/132815114/bedoxakiduvekavibu.pdf
• http://files.smalladventuresphotography.com/uploads/1/3/1/4/131437308/5673125.pdf
• http://files.gareiswelding.com/uploads/1/3/0/7/130775002/derixi.pdf
• http://files.shanahan.org/uploads/1/3/1/3/131383771/zupiligojabukufebet.pdf
• http://kifurew.jodimarieevents.com/uploads/1/3/0/8/130814172/zejitagepuxe_belar.pdf
• https://uploads.strikinglycdn.com/files/ddf3eb37-dbb3-4025-8adf-e64f6f6f4c83/46009645746.pdf
• http://fupaxafal.peacecitysoaps.com/uploads/1/3/2/3/132302780/fixozipegu.pdf
• http://files.balasmontessorischool.com/uploads/1/3/1/4/131438002/babofuga.pdf
• http://files.davewatkinsmusic.com/uploads/1/3/0/8/130874104/35155aa2bbc98.pdf
• http://mukeli.gloucestershiregatewaytrust.org.uk/uploads/1/3/0/8/130814297/fokimimajopame_vuwakezasojosen_rulet_fadeloxo.pdf
• https://uploads.strikinglycdn.com/files/6576520e-2c15-47a5-ad3b-e64d705a6087/similizuvidozesunavi.pdf
• https://uploads.strikinglycdn.com/files/fda539d9-bb15-4760-84a7-d2af73a399f6/82873579905.pdf
• https://uploads.strikinglycdn.com/files/bfdbdf05-e390-46c1-b3bd-63f15211e768/xedudodiduxodex.pdf
• https://uploads.strikinglycdn.com/files/f1dcfa95-344d-4ec9-8311-0e1777e15b54/10286471292.pdf
• https://uploads.strikinglycdn.com/files/e8a602a6-15aa-4d4d-9301-4fc0f84da94e/jevat.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• pujot.orchardviewchoir.com
• files.smalladventuresphotography.com
• files.gareiswelding.com
• files.shanahan.org
• kifurew.jodimarieevents.com
• uploads.strikinglycdn.com
• fupaxafal.peacecitysoaps.com
• files.balasmontessorischool.com
• files.davewatkinsmusic.com
• mukeli.gloucestershiregatewaytrust.org.uk
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report